4 ms·

No, it is not bad practice. Only developers who don't care about money actually coming through the door -- the same ones that get caught up in a local maxima tr

No, it is not bad practice. Only developers who don't care about money actually coming through the door -- the same ones that get caught up in a local maxima trying to perfect the imperfect -- say that it's bad and that you should not do it.

kbolino 2y ago
Regardless of what developers think, the payment providers generally forbid it. For example, Stripe says: > Don’t use real card details. The Stripe Services Agreement prohibits testing in live mode using real payment method details. Use your test API keys and the card numbers below. https://docs.stripe.com/testing https://docs.stripe.com/testing
- mjr00 2y ago
  I think you're misunderstanding here; people are talking about a smoke "test" using a real credit card against the real production payment system, using production API keys/authentication/etc, with real money moving around. No payment provider forbids that.
  - anonymoushn 2y ago
    That's precisely what they all forbid?
    - mjr00 2y ago
      They forbid using a valid credit card to make a purchase on a production system?
      - toast0 2y ago
        Yes. By the letter of the agreement, you are not to use your cards to do test purchases against your account. You ocassionally see complaints about payment processors when microbusinesses do this and get banned. So it is something that does get checked ocassionally. (There's a top level comment about this) I think the payment processor doesn't want you to do it because you may issue many transactions and then refund them which incurs cost, or you may be using it for manufactured spend which incurs issuer ire. Maybe it's a brown M&M thing; if you didn't read that part of the agreement, you didn't read anything else, and they may as well kick you out early and avoid hassle.
        giobox 2y ago
        Generally speaking, no one is getting banned from Stripe for the occasional transaction tested in production, come on. If this was the case, virtually every company I've ever worked at would be banned from Stripe. It's reasonable to confirm your system actually works once deployed outside of test environments. No disagreement from me that is what the letter of the Stripe service agreement says, but what happens in reality is clearly different. I take that rule as trying to encourage people to use the very good test environments Stripe offer, or to limit scale of test transactions in production, rather than trying to shutdown a paying user (the company) for trying a legitimate transaction in prod with a legitimate card. I have no idea why you would want to risk the first ever transaction in prod being performed by a real customer - why leave it to chance that it is not setup correctly? I have also been on calls with Stripe support staff where we tried a card transaction in production for testing purposes, FWIW.
      - kbolino 2y ago
        But it's not a purchase. You're not exchanging real goods or services for that money (unless your smoke tests run a lot deeper than mine). Your motives may be benign, but from a legal/regulatory perspective, it's a suspicious transaction.
      - JoshTriplett 2y ago
        Among other things, you're not allowed to use your own credit card to make a purchase where the money will come back to you, because credit cards want to charge cash advance rates for that.
  - kbolino 2y ago
    I can't find any clarification on this by a search alone. When I went looking for it in the actual services agreement, I couldn't even find any clause about testing at all.
- macNchz 2y ago
  I have to imagine they’d only care if you were running significant volumes of test transactions and refunding thems, like if you were using live credentials in a dev environment. Either way I’d be hard pressed to deploy significant changes to payment-related code in production without at the very least seeing a real $1 charge go through and everything work as expected. The risk of a ToS enforcement for this seems much lower than the risk of some bad logic in an if (env == ‘prd’) making customers unable to give you money.
  - kbolino 2y ago
    This is my read on it as well, but I'd really like an official clarification. Rare production smoke tests are in a gray area. They may be technical violations but they're allowed to happen as long as they stay infrequent and above-board (company card, small amount, no chargeback, etc.).
- squirrel 2y ago
  Also very interested. I wonder if we could get a comment from a Stripe person or a recently ex (like @patio11 ) to clarify what’s allowed and what’s just ignored.
  - dboreham 2y ago
    Their lawyers are going to tell them to go ahead and speak plainly here. Yeah no.
  - anonymoushn 2y ago
    It's not allowed, to make sure that all customers are always in violation of the agreement :)

kbolino 2y ago

Regardless of what developers think, the payment providers generally forbid it. For example, Stripe says: > Don’t use real card details. The Stripe Services Agreement prohibits testing in live mode using real payment method details. Use your test API keys and the card numbers below. https://docs.stripe.com/testing https://docs.stripe.com/testing

mjr00 2y ago
I think you're misunderstanding here; people are talking about a smoke "test" using a real credit card against the real production payment system, using production API keys/authentication/etc, with real money moving around. No payment provider forbids that.
- anonymoushn 2y ago
  That's precisely what they all forbid?
  - mjr00 2y ago
    They forbid using a valid credit card to make a purchase on a production system?
    - toast0 2y ago
      Yes. By the letter of the agreement, you are not to use your cards to do test purchases against your account. You ocassionally see complaints about payment processors when microbusinesses do this and get banned. So it is something that does get checked ocassionally. (There's a top level comment about this) I think the payment processor doesn't want you to do it because you may issue many transactions and then refund them which incurs cost, or you may be using it for manufactured spend which incurs issuer ire. Maybe it's a brown M&M thing; if you didn't read that part of the agreement, you didn't read anything else, and they may as well kick you out early and avoid hassle.
      - giobox 2y ago
        Generally speaking, no one is getting banned from Stripe for the occasional transaction tested in production, come on. If this was the case, virtually every company I've ever worked at would be banned from Stripe. It's reasonable to confirm your system actually works once deployed outside of test environments. No disagreement from me that is what the letter of the Stripe service agreement says, but what happens in reality is clearly different. I take that rule as trying to encourage people to use the very good test environments Stripe offer, or to limit scale of test transactions in production, rather than trying to shutdown a paying user (the company) for trying a legitimate transaction in prod with a legitimate card. I have no idea why you would want to risk the first ever transaction in prod being performed by a real customer - why leave it to chance that it is not setup correctly? I have also been on calls with Stripe support staff where we tried a card transaction in production for testing purposes, FWIW.
    - kbolino 2y ago
      But it's not a purchase. You're not exchanging real goods or services for that money (unless your smoke tests run a lot deeper than mine). Your motives may be benign, but from a legal/regulatory perspective, it's a suspicious transaction.
    - JoshTriplett 2y ago
      Among other things, you're not allowed to use your own credit card to make a purchase where the money will come back to you, because credit cards want to charge cash advance rates for that.
- kbolino 2y ago
  I can't find any clarification on this by a search alone. When I went looking for it in the actual services agreement, I couldn't even find any clause about testing at all.
macNchz 2y ago
I have to imagine they’d only care if you were running significant volumes of test transactions and refunding thems, like if you were using live credentials in a dev environment. Either way I’d be hard pressed to deploy significant changes to payment-related code in production without at the very least seeing a real $1 charge go through and everything work as expected. The risk of a ToS enforcement for this seems much lower than the risk of some bad logic in an if (env == ‘prd’) making customers unable to give you money.
- kbolino 2y ago
  This is my read on it as well, but I'd really like an official clarification. Rare production smoke tests are in a gray area. They may be technical violations but they're allowed to happen as long as they stay infrequent and above-board (company card, small amount, no chargeback, etc.).
squirrel 2y ago
Also very interested. I wonder if we could get a comment from a Stripe person or a recently ex (like @patio11 ) to clarify what’s allowed and what’s just ignored.
- dboreham 2y ago
  Their lawyers are going to tell them to go ahead and speak plainly here. Yeah no.
- anonymoushn 2y ago
  It's not allowed, to make sure that all customers are always in violation of the agreement :)